The platform-ui-colors npm package version 35.8.1 contains malicious code that, when required, fetches and executes an opaque binary from attacker-controlled Cloudflare Workers hosts. This binary is written to a temporary location on disk, made executable, and launched detached from the main process, resulting in arbitrary code execution on the host under the installer's user context. The malicious code uses obfuscation techniques to evade static analysis and does not verify the integrity of the fetched binary. This leads to a persistent staged binary on the affected system.